Cisco Talos Links SD-WAN Exploit to Volt Typhoon-Affiliated Key Theft

Cisco’s Talos intelligence group reported that a highly sophisticated threat actor exploited a critical SD-WAN vulnerability, CVE-2026-20127. The actor’s infrastructure overlapped with China’s Volt Typhoon group.

The attackers deployed custom malware called KeyDrift to steal encryption keys from compromised SD-WAN controllers. This gave them persistent access and the ability to siphon off keying material.

The activity was linked to the Silent Train network, which Volt Typhoon has used in other zero-day campaigns. The broader threat actor, identified as UAT-11473, has targeted organizations in the defense, aerospace, and space and satellite sectors.

Cisco described the attacks as historical. The detailed report linking KeyDrift and the advanced persistent threat (APT) group is new information.